VMware Cloud Community
paul007_ts
Contributor
Contributor

ESXi 7.0 - Lots of irrelevant logs send to Syslog Server

I have set syslog configuration in ESXi to send log to syslog server. I have set the syslog log filtering level to "error".

Syslog.global.logLevel = error

Based on my understanding of the setting of Syslog.global.logLevel, the server should not send any log other than "error" level to the syslog server.

However, there are still many logs of "hostd", "vpxa" and "rhttpproxy" comes to the syslog server and most of them are "Local4.Debug" and "Local4.Info".

Please see the sample below:

2022-11-30 17:01:38 Local4.Info 10.34.123.123 2022-11-30T09:01:38.615Z host-name Hostd: info hostd[2100926] [Originator@6876 sub=Libs opID=SWI-4baee9c0-94-b857 user=vpxuser] Unable to connect to vaai-nasd socket [No such file or directory]

2022-11-30 17:01:38 Local4.Info 10.34.123.123 2022-11-30T09:01:38.632Z host-name Vpxa: info vpxa[2101285] [Originator@6876 sub=vpxaInvtHost opID=WFU-5a029fae update=3410209] Increment master gen. no to (152973): VmLayout:VpxaInvtVmListener::LayoutChanged

2022-11-30 17:01:32 Local4.Debug 10.34.123.123 2022-11-30T09:01:32.974Z host-name Rhttpproxy: verbose rhttpproxy[2099091] [Originator@6876 sub=Proxy Req 94537] Resolved endpoint : [N7Vmacore4Http16LocalServiceSpecE:0x000000617ce90990] _serverNamespace = /vpxa action = Allow _port = 8089

Reply
0 Kudos
1 Reply
Chris_K2
Contributor
Contributor

I'm having the same problem with Esxi 8.0b. Driving me nuts. Sending the data to Splunk. Both the CLI and GUI report log level is warning. I also changed this around to log level info and error. 

There must be a bug in the software.... 

[root@localhost:~] esxcli system syslog config logfilter get

   Log Filtering Enabled: true

[root@localhost:~] esxcli system syslog config get

   Log Level: warning

   Remote Host: udp://10.12.1.118:514

#removed unrelated config lines

Reply
0 Kudos